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Presented to the Court by the foreman of the 
Grand Jury in open Court, in the presence of 
the Grand Jury and FILED in the U.S. 
DISTRICT COURT at Seattle, Washington. 



UNITED STATES DISTRICT COURT FOR THE 

WESTERN DISTRICT OF WASHINGTON 
AT SEATTLE 

UNITED STATES OF AMERICA, NO.C R1 9 “ 0 0 7 JLR 

Plaintiff, 

INDICTMENT 

v. 

HO JUN JIA, 
a/k/a Matthew Ho, 
a/k/a “Prefinity,” 
a/k/a “Ethereum Vendor,” 

Defendant. 


The Grand Jury charges that: 

1. For purposes of this Indictment: 

a. The defendant, HO JUN JIA, also known as Matthew HO 
(hereinafter, “HO”), is a resident and citizen of the Republic of Singapore. 

b. Amazon.com, Inc. (hereinafter, “Amazon”) is an electronic 
commerce, cloud computing, and consumer electronic device company headquartered in 
Seattle, Washington, within the Western District of Washington. 

c. Amazon Web Services (hereinafter, “AWS”) is a subsidiary of 
Amazon that provides on-demand cloud computing platforms to individuals, companies 
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and governments, on a paid subscription basis. AWS provides subscribers with access to 
a variety of computing services and differing levels of storage and computing power 
through the Internet. AWS operates out of Seattle, Washington, within the Western 
District of Washington. 

d. “Victim-1” is a resident of the state of California and is the co¬ 
founder of a video game developer and eSports tournament organizer based in Los 
Angeles, California (hereinafter, “Company-1”). 

e. “Victim-2” is a resident of the state of Texas. 

f. “Victim-3” is a resident and citizen of a foreign country and believed 
to be the co-founder and an executive of a technology company in the Republic of India. 

g. Cloud Computing is the practice of using a network of remote 
servers hosted on the Internet, commonly referred to as “the cloud,” to store, manage, and 
process data, rather than a local server or a personal computer. 

h. Cryptocurrency is a digital currency or asset that employs encryption 
or cryptography techniques to secure and verify the transfer of funds and to regulate the 
generation of additional units of currency. Cryptocurrencies operate independently of a 
central bank system and typically work through distributed ledger technology, a public 
and decentralized ledger commonly referred to as a “blockchain,” that serves as a public 
financial transaction database. Examples of decentralized cryptocurrencies include 
Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), Zcash (ZEC), Dash (DASH), Ripple 
(XRP), and Monero (XMR), among many others. 

i. Cryptocurrency mining is the process by which cryptocurrency 
transactions are verified and added to the public ledger, i.e., the blockchain, and also the 
means through which new cryptocurrency units are generated and released. Generally 
speaking, transactions are verified and assembled into “blocks” through the creation of 
hashes that fulfill certain requirements, which are then appended to the blockchain. 

Those that carry out the task of verifying “blocks” of legitimate transactions, often 
referred to as “miners,” are rewarded with an amount of that cryptocurrency. With the 
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growth and increased prevalence and valuation of cryptocurrencies, successful mining 
operations have required and consumed increasingly large amounts of computing power 
and hardware. 

COUNTS 1 - 8 

(Wire Fraud) 

A. Overview 

2. The defendant, HO JUN JIA, a/k/a Matthew HO, operated a large-scale 
cryptocurrency mining operation, propelled predominantly, if not exclusively, through 
fraud and identity theft. HO, a resident and citizen of Singapore, engaged in a 
sophisticated fraud scheme that involved the use of stolen personal and financial 
information of individual victims, including U.S. citizens, and a web of fraudulently 
registered accounts at various online service providers, such as Amazon and AWS, to 
gain access to immense amounts of computer processing power and storage, which he 
used to mine various cryptocurrencies. Through such mining activity, HO acquired 
cryptocurrency, such as Bitcoin and Ethereum, which he in turn sold and exchanged for 
traditional funds through online cryptocurrency vendor websites. 

3. More specifically, as discussed in more detail below, beginning in late 
2017, which followed the surge in popularity of cryptocurrencies, HO used victims’ 
personal and stolen credit card information, along with phony email addresses, which he 
created, designed to spoof the authentic email account of identity-theft victims, to open 
accounts and to obtain access to cloud computing services. HO employed social 
engineering techniques to trick providers into approving heightened privileges and 
benefits, including elevated levels of cloud computing services and deferred billing 
accommodations, and to deflect inquiries from service providers regarding questionable 
data usage and mounting unpaid subscription balances. 

4. For instance, in October and November 2017, HO opened numerous 
accounts at Amazon (retail), AWS and Google Cloud Services in the name of Victim-1, a 
resident of California, using Victim-l’s personal information, including his name, 
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address, and credit card information, along with a seemingly authentic email account and 
California state driver’s license. By associating with Victim-l’s company, Company-1, a 
legitimate and sizeable AWS customer, and through social engineered communications 
and additional deceptive tactics, HO gained access to a premium suite of cloud 
computing services and, for a brief period, was one of AWS’s largest consumer of data 
usage by volume. 

5. HO also created a fictitious individual to communicate with AWS 
ostensibly on Victim-l’s behalf, designed to legitimize the abnormal cloud computing 
usage. For instance, HO registered an online domain designed to spoof the name of 
another video game developer based in Los Altos, California (hereinafter, “Company-2”) 
recently acquired by Company-1 (Victim-l’s company). Using that spoofed domain, HO 
then created an email account for a non-existent person, “Daniel Piers,” which he used to 
communicate with AWS regarding billing issues and account maintenance ostensibly on 
Victim-l’s behalf. The exploitation of Company-1 and Company-2 illustrates HO’s 
sophistication and use of social engineering to perpetuate the fraud scheme. 

6. HO used the fraudulently-created cloud services accounts and computing 
power and data storage primarily, if not exclusively, as part of a large-scale 
cryptocurrency mining operation, which he supported through additional third-party 
services similarly acquired through fraud and the use of victim information. Through 
such mining activity, HO acquired cryptocurrency to enrich himself. 

7. HO registered and managed various accounts on cryptocurrency 
marketplace websites, such as localbitcoins.com and localethereum.com. Through these 
sites, and using monikers, to include “Prefinity” and “Ethereum Vendor,” HO sold and 
exchanged cryptocurrency, including Bitcoin and Ethereum obtained through the 
aforementioned mining activity, for traditional funds. HO also used social media, such as 
Facebook, to solicit interest in cryptocurrency and to advertise the fluctuations in price 
and exploit the growing attention to and popularity of cryptocurrency and virtual 
currency markets. 
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8. In furtherance of the scheme, HO consumed more than $5 million in unpaid 
cloud computing services. Portions (i.e., hundreds of thousands of dollars) of past due 
balances were charged to victim credit cards, some of which the accountholder paid 
before the fraud and compromise of the credit card account were discovered. 

B. Scheme and Artifice to Defraud 

9. The allegations set forth in Paragraphs 1 through 8 of this Indictment are 
re-alleged and incorporated as if fully set forth herein. 

10. Beginning at a time unknown, but no later than October 2017, and 
continuing until at least February 2018, at Seattle, within the Western District of 
Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, and others 
known and unknown to the Grand Jury, devised and intended to devise a scheme and 
artifice to defraud and to obtain money and property by means of materially false and 
fraudulent pretenses, representations and promises. 

11. The essence of the scheme and artifice to defraud was to use stolen personal 
and financial information to open accounts in the names of others, without authorization, 
in order to obtain things of value, including computing and data storage services. The 
scheme and artifice to defraud also involved the use of computing services to engage in a 
coordinated cryptocurrency mining operation to generate cryptocurrency units, a thing of 
value, which were then sold and exchanged for traditional government-issued currency. 
The object of the scheme and artifice to defraud, at bottom, was to achieve financial 
enrichment through fraud and deception. 

C. Manner and Means 

12. The manner and means of the scheme and artifice to defraud included the 
conduct described herein and the following: 

a. HO, either personally or through an accomplice, obtained personally 
identifiable information and financial information belonging to others, including, but not 
limited to, Victim-1, Victim-2, and Victim-3, without their knowledge or permission. 
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b. HO created phony email accounts, typically at Google (i.e., 
@gmail.com) or at unique domains that he registered and managed, designed to spoof 
authentic email accounts, including those of identity-theft victims. The fake email 
accounts were intended and used, in conjunction with additional information, to deceive 
and to obtain services and items of value. By way of example, 

i. On about October 19, 2017, HO created an email account in 
the name of Victim-1, namely, 


l@gmail.com, that incorporated Victim-l’s 
first initial and full last name (hereinafter, the “VI Email Account”). 

ii. On about November 18, 2017, HO created an email account 


in the name of Victim-2, namely, 


|@gmail.com, that incorporated Victim- 
2’s first and last name (hereinafter, the “V2 Email Account”). 

iii. On about November 24, 2017, HO created an email account 


in the name of Victim-3, namely, j 


|@gmail.com, that incorporated 
Victim-3’s first and last name (hereinafter, the “V3 Email Account”). 

c. HO used personal and financial information of others to open 
multiple retail accounts at Amazon. HO then attempted to purchase things of value, 
including instrumentalities of the scheme, using victim credit cards and accumulated 
membership rewards points. By way of example, 

i. On about October 19, 2017, HO opened an Amazon retail 
account in the name of Victim-1, using another email address incorporating Victim-l’s 
first and last name at a domain HO registered and managed, namely, 
imd@corestratos.com, and Victim-l’s American Express credit card information. 
On the same date, HO attempted to purchase computer-related items through this 
account, using Victim-1 ’s credit card. 

ii. On about October 20, 2017, HO opened another Amazon 
retail account in the name of Victim-1, using the VI Email Account, Victim-l’s credit 
card information, and the address of a property located in Santa Monica, California, 
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owned by Victim-1. On the same date, HO attempted to purchase a computer-related 
item through this account, using Victim-1 ’s credit card. 

iii. On about November 4, 2017, HO opened yet another Amazon 
retail account in the name of Victim-1, again using the VI Email Account and Victim-1 ’s 
credit card information and Santa Monica, California address. On about November 6, 
2017, HO attempted to purchase a Bitcoin mining contract through this account, using 
Victim-1 ’s credit card. 

d. HO used personal and financial information of others to open 
multiple accounts for cloud computing services at providers such as AWS and Google. 
HO, through use of social engineering and other deceptive tactics, sought elevated access 
and privileges related to data storage and usage. By way of example, 

i. On about November 1, 2017, HO opened a cloud services 
account with Google Cloud Services in the name of Victim-1, using the VI Email 
Account and Victim-l’s credit card information and Santa Monica, California address. 

ii. On about November 2, 2017, HO opened a cloud services 
account with AWS in the name of Victim-1, using the VI Email Account, Victim-l’s 
credit card information and Santa Monica, California address. 

iii. On about November 4, 2017, as verification for the AWS 
account opened in Victim- l’s name, HO submitted to AWS copies of an account 
statement for Victim-l’s credit card and a fake California driver’s license bearing Victim- 
1 ’s name and photograph. 

iv. On November 20, 2017, HO, through use of the VI Email 
Account, requested and obtained access for elevated privileges for the AWS account in 
Victim-1 ’s name. 

v. On about November 18, 2017, HO opened a cloud services 
account with AWS in the name of Victim-2, using the V2 Email Account and Victim-2’s 
Visa credit card information and address in Haltom City, Texas. 
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vi. On about November 24, 2017, HO opened a cloud services 
account with AWS in the name of Victim-3, using the V3 Email Account, Victim-3’s 
Visa credit card information, and an address in Singapore. 

vii. On about November 29, 2017, as verification for the AWS 
account opened in Victim-3’s name, HO submitted to AWS a copy of a bank statement of 
another person. 

e. HO also secured services and contracts from third-party vendors in 
relation to cryptocurrency mining activity. For instance, on about October 20, 2017, HO 
registered an account with CCG Mining, a company that provides cryptocurrency and 
blockchain consulting services, in Victim-l’s name and using the VI Email Account. 

HO then used the account to acquire information and services related to the mining, 
marketing, and sale of cryptocurrency, all using Victim-l’s identity, in furtherance of his 
fraudulent scheme. 

f. HO used the fraudulently obtained computing power and data 
storage and related services obtained through the cloud service providers primarily, if not 
exclusively, to mine cryptocurrency. As a result, HO earned and acquired units of 
cryptocurrency, such as Bitcoin and Ethereum, which he transferred into cryptocurrency 
wallets he maintained. 

g. HO registered domains and emails and created fictitious individuals 
to communicate with service providers ostensibly on the accountholder’s behalf. For 
instance, on about January 18, 2018, HO created a web domain designed to spoof 
Company-2 and an email account for “Daniel Piers,” which he used to communicate with 
AWS representatives about a billing arrangement for the AWS account opened in the 
name of Victim-1. 

h. HO, without authorization, authorized and caused payments for 
goods and services on the victim credit cards. By way of example, 

i. Beginning on about November 4, 2017, and on numerous 
dates thereafter, at least 16 payments in varying amounts, totaling roughly $240,000, 
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were charged to Victim-1 ’s credit card toward the balance owed on the Google Cloud 
Services account opened in the name of Victim-1. Such payments to Google include, but 
are not limited to, two payments totaling $40,000 on about February 20, 2018; two 
payments totaling $40,000 on about February 21, 2018; and three attempted charges 
totaling $105,000 on about February 22, 2018. 

ii. On about December 3, 2017, a payment in the amount of 
$135,861.12 was charged to Victim-l’s credit card toward the balance owed on the AWS 
account opened in the name of Victim-1. 

i. HO advertised, sold, and exchanged such cryptocurrency on various 
cryptocurrency marketplace websites, such as localbitcoins.com and localethereum.com, 
in order to obtain traditional funds. To conceal his true identity, HO used online 
monikers, such as “Prefinity” and “Ethereum Vendor,” respectively. 

j. HO also used social media and online services to solicit interest in 
cryptocurrency and to advertise the fluctuations in price and exploit the growing attention 
to and popularity of cryptocurrency and virtual currency markets. For instance, on about 
December 8, 2017, HO posted on Facebook the message: “ETH/BTC levels are at all 
time low since march when ETH cost around $36. ...whats your move?” 

D. Execution of Scheme and Artifice to Defraud 

13. On or about the dates set forth below, at Seattle, within the Western District 
of Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, and 
others known and unknown to the Grand Jury, having devised a scheme and artifice to 
defraud, and to obtain money and property by means of materially false and fraudulent 
pretenses, representations, and promises, did knowingly transmit and cause to be 
transmitted writings, signs, signals, pictures, and sounds, for the purpose of executing 
such scheme, by means of wire communication in interstate and foreign commerce, 
including the following transmissions, each of which caused the transmission of an 
electronic signal between the state of Washington and a location outside of the state of 
Washington, and each of which constitutes a separate count of this Indictment: 
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Count 

l)ate(s) 

Wire Transmission 

1 

11/2/2017 

Registration of AWS account in name of Victim-1 

2 

11/4/2017 

Submission of American Express credit card statement 
and driver’s license in the name of Victim-1 

3 

11/18/2017 

Registration of AWS account in name of Victim-2 

4 

11/20/2017 

Communication with AWS regarding cloud services 
privileges for account in the name of Victim-1 

5 

11/24/2017 

Registration of AWS account in name of Victim-3 

6 

11/30/2017 

Communication with AWS regarding account service 
for account in the name of Victim-1 

7 

12/3/2017 

Payment to AWS account in the name of Victim-1 
charged to Victim-l’s credit card 

8 

1/18/2018 

Generation and communication of payment 
instructions for AWS account in the name of Victim-1 


All in violation of Title 18, United States Code, Sections 1343 and 2. 


COUNTS 9 -12 
(Access Device Fraud) 

14. The allegations set forth in Paragraphs 1 through 12 of this Indictment are 
re-alleged and incorporated as if fully set forth herein. 

15. On or about the dates set forth below, at Seattle, within the Western District 
of Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, and 
others known and unknown to the Grand Jury, knowingly and with intent to defraud, used 
and trafficked in an unauthorized access device, as described below, and other means of 
account access that can be used, alone and in conjunction with another access device, to 
obtain a thing of value, and by such conduct, obtained things of value worth $1,000 or 
more during a one-year period; said activity affecting interstate and foreign commerce. 
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Count 

Date(s) 

Access Device 

9 

10/19/2017 

Victim-1’s credit card information 
(transmission to Amazon) 

10 

11/2/2017 

Victim-l’s credit card information 
(transmission to AWS) 

11 

11/18/2017 

Victim-2’s credit card information 
(transmission to AWS) 

12 

11/24/2017 

Victim-3’s credit card information 
(transmission to AWS) 


All in violation of Title 18, United States Code, Sections 1029(a)(2) and 
1029(c)(l)(A)(i), and 2. 

COUNT 13 

(Aggravated Identity Theft) 

16. The allegations set forth in Paragraphs 1 through 15 of this Indictment are 
re-alleged and incorporated as if fully set forth herein. 

17. On multiple dates, beginning on or about October 19, 2017, and including 
November 2, 2017, and continuing until January 2018, at Seattle, within the Western 
District of Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, 
did knowingly transfer, possess, and use, without lawful authority, a means of 
identification of another person, to wit: the name, address, and credit card information of 
Victim-1, a real person, during and in relation to a felony violation enumerated in 

18 U.S.C. § 1028A(c), that is, wire fraud, in violation of 18 U.S.C. § 1343, as charged in 
Counts 1,2, 4, 6, 7, and 8, and access device fraud, in violation of 18 U.S.C. § 1029, as 
charged in Counts 9 and 10, knowing that the means of identification belonged to another 
actual person. 

All in violation of Title 18, United States Code, Sections 1028A(a) and 2. 
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COUNT 14 

(Aggravated Identity Theft) 

18. The allegations set forth in Paragraphs 1 through 15 of this Indictment are 
re-alleged and incorporated as if fully set forth herein. 

19. On or about November 18, 2017, at Seattle, within the Western District of 
Washington, and elsewhere, the defendant, HO JUN JIA, a/k/a Matthew HO, did 
knowingly transfer, possess, and use, without lawful authority, a means of identification 
of another person, to wit: the name, address, and credit card information of Victim-2, a 
real person, during and in relation to a felony violation enumerated in 18 U.S.C. 

§ 1028A(c), that is, wire fraud, in violation of 18 U.S.C. § 1343, as charged in Count 3, 
and access device fraud, in violation of 18 U.S.C. § 1029, as charged in Count 11, 
knowing that the means of identification belonged to another actual person. 

All in violation of Title 18, United States Code, Sections 1028A(a) and 2. 

FORFEITURE ALLEGATION 

20. The allegations contained in Counts 1 through 8 of this Indictment are 
hereby realleged and incorporated by reference for the purpose of alleging forfeitures 
pursuant to Title 18, United States Code, Section 981(a)(1)(C) and Title 28, United States 
Code, Section 2461(c). Upon conviction of any of the offenses charged in Counts 1 
through 8, the defendant shall forfeit to the United States any property, real or personal, 
which constitutes or is derived from proceeds traceable to such offenses, including but 
not limited to a judgment for a sum of money representing the property described in this 
paragraph. 

21. The allegations contained in Counts 9 through 12 of this Indictment are 
hereby realleged and incorporated by reference for the purpose of alleging forfeitures 
pursuant to Title 18, United States Code, Sections 981(a)(1)(C) and 1029(c)(1)(C), and 
Title 28, United States Code, Section 2461(c). Upon conviction of any of the offenses 
charged in Counts 9 through 12, the defendant shall forfeit to the United States any 
property, real or personal, which constitutes or is derived from proceeds traceable to such 
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offense, and shall also forfeit any personal property used or intended to be used to 
commit such offense, including but not limited to a judgment for a sum of money 
representing the property described in this paragraph. 

(,Substitute Assets ) 

22. If any of the property described above, as a result of any act or omission of 
the defendant: 

a. cannot be located upon the exercise of due diligence; 

b. has been transferred or sold to, or deposited with, a third party; 

c. has been placed beyond the jurisdiction of the court; 

d. has been substantially diminished in value; or 

e. has been commingled with other property which cannot be divided 
without difficulty, 

// 

// 

// 
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